#!/usr/bin/env bash
# Rizoma WebPanel — publisher.
# Usage: publish.sh [channel] [repo-host]   (defaults: stable repo.rizomarl.com)
#
# Uploads the staged release to /var/www/repo/webpanel/<channel>/ on the repo
# server (binaries, SHA256SUMS[+.sig], version.json, install.sh).
# Auth: SSHPASS env (sshpass -e) or key-based BatchMode. Do not wrap this
# script itself with sshpass — nested commands must inherit SSHPASS.
# Mirrors rizoma-mesh packaging/scripts/publish.sh.
set -euo pipefail

root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
channel="${1:-stable}"
repo_host="${2:-repo.rizomarl.com}"
repo_user="${REPO_USER:-root}"
repo_base="${REPO_BASE:-/var/www/repo/webpanel}"

ssh_opts=(-o StrictHostKeyChecking=accept-new -o ConnectTimeout=15)
remote_ssh() {
  if [ -n "${SSHPASS:-}" ]; then sshpass -e ssh "${ssh_opts[@]}" "$repo_user@$repo_host" "$@"
  else ssh -o BatchMode=yes "${ssh_opts[@]}" "$repo_user@$repo_host" "$@"; fi
}
remote_scp() {
  if [ -n "${SSHPASS:-}" ]; then sshpass -e scp "${ssh_opts[@]}" "$@"
  else scp -o BatchMode=yes "${ssh_opts[@]}" "$@"; fi
}
remote_rsync() {
  if [ -n "${SSHPASS:-}" ]; then sshpass -e rsync -e "ssh ${ssh_opts[*]}" "$@"
  else rsync -e "ssh -o BatchMode=yes ${ssh_opts[*]}" "$@"; fi
}

version="$(python3 -c 'import json;print(json.load(open("packaging/version.json"))["version"])' 2>/dev/null || echo "")"
[ -n "$version" ] || { echo "packaging/version.json missing; run release.sh first" >&2; exit 1; }
stage="$root/packaging/stage/$version"
[ -d "$stage" ] || { echo "stage dir $stage missing; run release.sh $version $channel first" >&2; exit 1; }

# Validate installer before upload.
bash -n "$root/packaging/scripts/install.sh"

echo "==> remote layout"
remote_ssh "mkdir -p $repo_base/$channel $repo_base/keys"

echo "==> upload channel $channel version $version"
# NOTE: no --delete here. Remote retention (current + one previous per arch
# for rollback) is enforced by the prune step below; --delete would wipe the
# previous release whenever the local stage holds a single version.
remote_rsync -av "$stage/" "$repo_user@$repo_host:$repo_base/$channel/"
remote_scp "$root/packaging/version.json" "$repo_user@$repo_host:$repo_base/version.json"
remote_scp "$root/packaging/scripts/install.sh" "$repo_user@$repo_host:$repo_base/install.sh"
remote_scp "$root/CHANGELOG.md" "$repo_user@$repo_host:$repo_base/CHANGELOG.md"
remote_scp "$root/INSTALL.md" "$repo_user@$repo_host:$repo_base/INSTALL.md"
remote_scp "$root/README.md" "$repo_user@$repo_host:$repo_base/README.md"
remote_scp "$root/packaging/systemd/rizoma-webpanel.service" "$repo_user@$repo_host:$repo_base/rizoma-webpanel.service"

echo "==> prune to current + one previous per arch (mesh rollback policy)"
remote_ssh "cd $repo_base/$channel && ls -1 webpanel-*-linux-amd64 2>/dev/null | sort -V | head -n -2 | xargs -r rm -f; ls -1 webpanel-*-linux-arm64 2>/dev/null | sort -V | head -n -2 | xargs -r rm -f; (sha256sum webpanel-*-linux-* > SHA256SUMS 2>/dev/null || true); ls -la"

echo "==> verify"
curl -fsSL "https://$repo_host/webpanel/version.json"
echo
curl -fsSI "https://$repo_host/webpanel/install.sh" | head -n 1